@vercel/sdk). The token’s scope — personal account or a specific team — determines what the agent can reach. No OAuth flow is required.
Prerequisites
- A Vercel account with access to the teams and projects you want to investigate.
- An access token scoped to the right team.
- Permission to create tokens for that scope.
Scope the token to only the team CloudThinker needs. The connection’s read operations never mutate Vercel resources — only the three approval-gated controls do.
Setup
Create an Access Token
In Vercel, go to Settings → Tokens → Create Token:
- Name:
cloudthinker - Scope: pick the team (or personal account) CloudThinker should access
- Expiration: choose a lifetime and plan to rotate
Connection Details
| Field | Description | Example |
|---|---|---|
| VERCEL_TOKEN | Vercel access token used as the MCP bearer token | — |
CloudThinker resolves the team and projects from the token’s scope, so no manual team ID or URL configuration is required.
Required Permissions
Scope the token to the team whose projects, deployments, domains, and logs CloudThinker should reach. Read operations work with any token that can see those resources; the three control operations additionally require the token’s scope to allow them and explicit approval in CloudThinker.Agent Capabilities
Once connected, agents have read access to your Vercel projects and deployments.| Capability | Description |
|---|---|
| Teams & Projects | List teams and projects, and inspect project domains |
| Deployments | List and inspect deployments, deployment events, and build output |
| Runtime Logs | Fetch runtime logs for error triage |
| Domains & Aliases | Audit domains, domain configuration, and aliases |
| Account | Read the authenticated Vercel user |
| Deployment Control | Cancel deployments, pause and unpause projects — requires approval |
Cancel deployment, Pause project, and Unpause project are approval-gated. CloudThinker requests confirmation before running them; read-only operations run without approval.Example Prompts
For accounts with many projects, scope requests to a single team or project so the agent returns focused results.
Troubleshooting
401 or 403 Unauthorized
401 or 403 Unauthorized
Agent cannot see expected teams or projects
Agent cannot see expected teams or projects
The token’s scope does not include those teams. Create a new token scoped to the correct team and reconnect.
CloudThinker says Vercel is already connected
CloudThinker says Vercel is already connected
Only one Vercel connection is allowed per workspace. Use the existing connection or remove it before reconnecting.
Control action did not run
Control action did not run
Cancel, pause, and unpause require both a token scope that permits the action and explicit approval in CloudThinker. Approve the action when prompted, and confirm the token’s scope allows it.
Security Best Practices
- Least-privilege scope - Scope the token to only the team CloudThinker needs
- Set an expiration - Prefer short-lived tokens and rotate them regularly
- Approval for controls - Keep cancel, pause, and unpause approval-gated
- Reconnect carefully - Remove the existing connection before switching tokens
- Revoke when unused - Delete the token in Vercel if you stop using the connection
Related
MCP Connection
Connect custom tools and services with MCP
Approval
How approval-gated actions work